Filip
Hi my name's Filip, I'm from Poland. I have been a penetration tester in the UK for the past 3.5 years working for various companies. As of recently, I've become a part of the adversary simulation team at JUMPSEC. Outside of pentesting, I enjoy playing football!
Session
Join us on a demonstration of a TWIG language Server-Side Template Injection (SSTI) vulnerability identified and successfully exploited in a real, client engagement. Through the vulnerability we obtained command execution with command output landing in our email inbox, leading to a reverse shell and subsequently pivoted into the client Google Cloud Platform (GCP) cloud environment by leveraging application credentials once foothold has been established.
Beyond the interesting war story, we will explore ways to go about looking for different SSTI vulnerabilities, how to discover attack surfaces for different templating engines and how to safely exploit these, showcase pivoting opportunities into cloud environments such as GCP to showcase customer impact and handle client communications.